Auditing a health application that has run since 2019

I was contacted about this hospital application, and it mattered to me. A child with Marfan syndrome can't do just any sport at school, and a vague unfitness certificate excludes them from everything. The application has three specialists answer a questionnaire, crosses the answers with a reference list of school activities, and produces a certificate that says, sport by sport, what is allowed. Twelve hospital centres, around 200 to 260 certificates a year since 2019.

The core logic fits in about fifty lines, and the aorta comes first. If no cardiology answer allows an activity, it's forbidden outright. Otherwise a single contraindication is enough to refuse it. All the intelligence sits in the mapping from answers to authorisations, which the super-administrator manages themselves.

The audit found a stack entirely out of support, Symfony 4.2, PHP 7.2, PostgreSQL 9.6, Debian 9, with 60 published vulnerabilities including 5 critical, no backups, and e-mail delivery broken since 2022. And six major flaws, including certificates reachable without logging in, the database and Adminer open to the Internet, and passwords in clear. The "hospital identifier" field in practice held the child's first and last name.

I delivered 23 pages of reproducible findings, six quotes, a comparison, a maintenance contract, a note for the DPO and an acceptance checklist per role. Then an emergency hardening branch, 12 commits and 69 green tests, which moves the certificates out of the web root, partitions the centres, adds an anti-CSRF token, removes the password from e-mails and hardens nginx.

Deployment follows three short windows, with a dress rehearsal on a local replica of production and a per-role acceptance. The proposed next step is a rebuild on Symfony 7, PHP 8, PostgreSQL 16 and Docker, with a certificate history and an action log, which don't exist today.

It's a health application. On the site, it's presented as a case study, with reconstructed screens and no real data.